The Department of Veterans Affairs (VA) Office of Inspector General (OIG) said the agency’s modernization of a mission-critical benefits support system faces risks of further delays, higher costs, and security vulnerabilities because of gaps in program management and oversight.
In an Aug. 11 report, the OIG found that VA’s Office of Information and Technology (OIT) lacks a comprehensive program schedule and reliable life cycle cost estimate for the Benefits Enterprise Platform (BEP) modernization initiative. Auditors also found security assessment gaps that VA has since addressed.
BEP supports veterans’ benefits processing, allowing information to flow between the Veterans Benefits Administration database and systems supporting compensation and pension, education, vocational rehabilitation and employment, and loan guaranty programs.
“Without a reliable schedule and cost estimate, VA management risks not making fully informed decisions,” the report says. “Furthermore, the lack of required security assessments, which VA has since addressed, may have increased the risk that veterans’ sensitive personal information was compromised.”
“Schedule and cost concerns will persist until OIT develops a reliable program schedule and a validated life cycle cost estimate,” it adds.
VA awarded a $1.1 billion contract in May 2021 to Booz Allen Hamilton to modernize benefits delivery systems, including BEP, with the contract originally expected to be completed in August 2026. But VA’s current planning dashboard projects BEP modernization will continue until the second quarter of fiscal year 2034, according to the OIG.
The watchdog said OIT is using an agile project management tool that only plans work in three-month increments. The tool does not provide a roadmap covering the project’s full life cycle, including all requirements, dependencies, milestones, and deliverables.
Auditors also found conflicting BEP cost estimates across VA planning documents. One five-year plan estimated about $150.3 million in costs for fiscal years 2023 through 2027, while a later addendum listed about $117 million. An OIT financial summary and multiyear plan put the figure at about $161.9 million.
The OIG said OIT could not provide documentation supporting some planned costs, preventing auditors from determining whether cost estimates were accurate or covered the full scope of the BEP modernization effort.
VA pushed back on that finding, telling the OIG that its BEP life cycle cost estimates are “high-quality, reliable, comprehensive, well-documented, accurate, and credible,” while agreeing to strengthen its cost-estimating processes.
The audit also found that OIT had hosted some applications without approved security assessments, potentially putting veterans’ sensitive personal information at risk. After auditors notified VA in March 2025, the department assessed the applications and resolved the identified vulnerabilities.
The OIG issued five recommendations covering program scheduling, reporting, cost estimating, cost tracking, and security assessments. VA concurred with the first four and concurred in principle with the fifth.
For the first four recommendations, OIT set an Oct. 31 deadline to provide the OIG with details on strengthened scheduling, reporting, and cost-management processes.